Privacy Policy

We value your trust so it’s important that we are transparent about how we use your personal information. This Privacy Policy explains how and why we collect and handle personal information.

If you have any questions or need more information about anything in this Privacy Policy, please contact our privacy team using the details provided at the end of this policy.

Vicinity Centres (‘Vicinity’, ‘we’ or ‘us’) is a property group that owns, builds and manages shopping centres and mixed-use sites in Australia.

Vicinity includes Vicinity Limited ABN 90 114 757 783, Vicinity Centres Trust ARSN 104 931 928 and their respective controlled entities, including Vicinity Centres PM Pty Ltd ABN 96 101 504 045.

We are based in Australia, and this Privacy Policy explains how we collect and handle your personal information in line with the Australian Privacy Principles (APPs) contained in the Privacy Act 1988 (Cth).

Personal information means information which identifies you or from which you are reasonably identifiable.

The types of personal information we collect will depend on how and why you engage with us, but can include:

• General information, such as your name, date of birth, gender, and signature. We may collect information about nationality where this is necessary to help us locate a lost person in our centres

• Contact information, such as your email, phone number, social media handles, and address

• Images and recordings of you, including CCTV footage, photographs, descriptions of your likeness, and voice recordings

• Identification information, such as details from, or copies of, your driver’s licence or passport

• Information about the services we have provided and the interactions we have had with you

• Information about security, health, or safety incidents you have been involved in or witnessed

• Information about, and images of, the vehicle/s (including licence plates) you drive to or park at our centres

• Your preferences, such as centre locations, app features, website pages, and interests

• Payment details

• Usage and device data, such as device identifiers, IP address, MAC address, browser type, and WiFi access dates, times and locations

• Any information you give us when you take part in a competition, surveys, make an enquiry or provide us with feedback

• Your approximate location within our centres

• For securityholders, information about your securityholding

• For job applicants, information about your employment history, education background, eligibility to work, relevant licences or permits, and your Tax File Number

• For service providers, information about insurances held, licences, permits, time and attendance records

• For licensees, tenants, sole traders and guarantors, where relevant to the administration of a licensing or leasing arrangement or recovery of outstanding amounts owing under such an arrangement, information relating to unpaid obligations, personal guarantees and payment default information.

We may collect the following types of sensitive information:

• Health information, for example when you are injured in one of our centres, or provide dietary requirements

• Information about your race or ethnicity where this is reasonably necessary to manage incidents or suspected offences, or reunite lost/found persons

• Information about religious beliefs, where these can be inferred from your dietary requirements

• Criminal record

In some cases, if we cannot collect the personal information which we request from you, we may not be able to provide you with access to some of our locations, products or services.

We collect personal information in several ways.

From you

We collect personal information from you in different situations, including when you:

• Contact us in person, by phone, email, letter, website or app

• Are involved in, or witness, a security, health, or safety incident at one of our centres or offices

• Register for or use our Digital Services. Our Digital Services include our websites, applications, booking platforms, centre news subscriber services, centre social media channels, centre public WiFi and email communications

• Participate in our competitions or surveys

• Apply for a role with us

• Apply to lease or licence one of our spaces

• Interact with us on social media or tag us in social media posts

From recording devices operating in our centres

We operate CCTV (and related cameras and technology) and body-worn cameras in our centres, car parks and offices.

From other individuals

We may collect personal information about you from other individuals, for example:

• When you are involved in a security, health, or safety incident at one of our centres

• When someone purchases a gift card for you

• Your legal representatives

• Referees you have provided in support of a job application

• Guarantors in respect of your leasing application

From third parties

We may collect your personal information from third parties we have a relationship with, for example:

• Retailers

• Our hotel and car park operators

• Our Security Registry provider

• Our service providers

• Marketing and research partners

• Commercial default listing providers and debt recovery service providers

• Government and law enforcement agencies

• Insurers

• Our related entities or joint venture partners

From your online activities and devices

We collect personal information when you register for, and use, the public WiFi services provided in our centres and offices. We also collect information about the location of WiFi enabled devices in our centres. You can opt out of sharing your device’s location by turning off WiFi on your device while visiting our centres.

We use cookies and similar technologies on our website and applications to collect usage and device data. We use third party tracking pixels on our websites and digital communications to collect data about the actions users take when interacting with those channels. You can change your cookie settings in your browser. If you delete cookies, some parts of our websites may not work.

Beacon technology is also used in our centres for monitoring devices which are Bluetooth enabled.

From publicly available sources

We may collect your personal information from publicly available sources, including social media.

We collect, hold, use, and disclose your personal information in order to:

• Operate our centres, car parks, and other facilities

• Keep our centres, car parks and other facilities safe and secure

• Analyse occupancy, traffic, shopper behaviour and sentiment, and demographics

• Deliver services (including Digital Services) to you, and manage your bookings

• Improve our centres and services (including Digital Services)

• Administer competitions that we run

• Lease or licence spaces to you

• Provide you with marketing communications, unless you have opted out of such communications

• Provide you with relevant advertising and measure the performance of our advertising

• Promote our centres, services, and offerings

• Identify, investigate and respond to security, health (including public health), and safety incidents, as well as suspected or potential offences

• Conduct market research

• Respond to complaints, queries and feedback

• Report incidents

• Issue and enforce ban notices

• Manage insurance obligations and claims

• Administer gift cards, and monitor gift card usage for fraud and suspicious transactions

• Manage your security holding

• Assess your suitability for a role with us

• Manage our internal operations, including billing and finance, audit, business planning, corporate governance, systems development and improvement, coaching, and training

• Meet our legal obligations

• As otherwise permitted or required by law

• Administer licence and leasing arrangements, recover outstanding amounts owing under such an arrangement and, where permitted by law, disclose information to commercial default listing providers for the purposes of recording, updating or removing payment default listings

This section applies only to the collection, use and disclosure of personal information in connection with the recovery of outstanding amounts owing under a licence or lease and the recording, updating or removal of commercial payment default listings. It does not relate to application-stage credit checks, credit assessments or evaluations of creditworthiness.

Where you are a licensee, tenant, director, guarantor or sole trader under a Vicinity licence or leasing arrangement, we may collect, hold, use and disclose your personal information and commercial credit-related information in connection with:

• Administering licence or leasing arrangements; recovering outstanding amounts owing under a licence or lease; where permitted by law, requesting the recording, updating or removal of commercial payment default listings where permitted by law.

Where permitted by law, we may disclose personal information that is reasonably necessary to commercial payment default listing providers (including Equifax Pty Ltd) and debt recovery service providers for the purposes of recovering outstanding licence or lease fees and recording, updating or removing payment default listings.

We may share your personal information with others, including:

• Related entities

• Joint venture partners that we operate centres with, and prospective property buyers

• Retailers

• Law enforcement agencies

• Service providers that support our business operations and centre management, including those delivering essential services such as security and call centre support

• Technology service providers that provide and support our in-centre, online and back-end systems

• Commercial payment default listing providers (including Equifax Pty Ltd), debt recovery service providers and, where required by law, other authorised recipients

• Marketing and communications platform providers and agencies

• Market research and insights agencies

• Event partners

• Car park and hotel operators

• Our Security Registry provider if you are a securityholder

• Our insurers, banks, payment processors and debt collection services

• Our website users and social media followers, where you have opted to publicly share your personal information via these channels (for example, by tagging us in a post)

• Your agents or individuals acting on your behalf

• Regulators, Government agencies and courts

We will share your personal information for the purposes we have listed above, where you have provided your consent, or as otherwise permitted or required by law.

We mostly store personal information in Australia. However, some of our service and technology providers may operate and handle personal information overseas, including in the United States, Singapore, the European Union (for example, France and Germany), New Zealand, the United Kingdom, Canada, India, Japan and the Philippines.

If you are a securityholder residing outside Australia, we may also provide your personal information to authorities of the jurisdiction in which you reside, such as tax authorities, banks and other permitted bodies.

We store personal information electronically and in hard copy. We store personal information at our premises, with our service providers, and in the cloud.

We take reasonable steps to protect the personal information we hold from misuse, interference and loss, and from unauthorised access, modification or disclosure.

You can seek access to, or correction of, the personal information we hold about you by contacting our privacy team using the details provided at the end of this Privacy Policy.

Before we give you access to information or agree to correct your information, we may require you to verify your identity.

If you have a concern or complaint about our handling of your personal information, please contact our Privacy Officer using the contact details provided at the end of this Privacy Policy.

We acknowledge every complaint we receive, provide contact details for the privacy team and keep you updated on the progress we are making in investigating your complaint.

We also work towards responding to you and resolving your concern or complaint within a reasonable timeframe. If we are unable to provide a final response within 30 days we will contact you to explain why and discuss an appropriate timeframe to investigate the complaint.

If you are not satisfied with our handling of, or response to, your complaint, you can contact the Office of the Australian Information Commissioner via:
Phone: +61 1300 363 992
Website: oaic.gov.au
Post: Office of the Australian Information Commissioner
GPO Box 5288
SYDNEY NSW 2001

For privacy questions, access or correction requests, complaints, or enquiries relating to this Privacy Policy, please contact our Privacy Officer:
Email: privacy@vicinity.com.au
Phone: +61 3 7001 4000 Monday to Friday between 9.00am and 5.00pm Melbourne time
Post:
ATT: Privacy Officer
Vicinity Centres
Level 4, Chadstone Tower One
1341 Dandenong Road
CHADSTONE VIC 3148
Australia

We may update this Privacy Policy from time to time. We recommend that you check this Privacy Policy regularly for any changes.

This Privacy Policy was last updated on 11 September 2026.